Index: drivers/char/msm_kgsl/kgsl.c |
diff --git a/drivers/char/msm_kgsl/kgsl.c b/drivers/char/msm_kgsl/kgsl.c |
index a5625604f0ad10f57452a41feef931891c0cd463..8a89a1aee89dbccdc4b2424ddfdecea3428aa2e9 100644 |
--- a/drivers/char/msm_kgsl/kgsl.c |
+++ b/drivers/char/msm_kgsl/kgsl.c |
@@ -826,7 +826,8 @@ error: |
#endif /*CONFIG_MSM_KGSL_MMU*/ |
static long kgsl_ioctl_sharedmem_from_pmem(struct kgsl_file_private *private, |
- void __user *arg) |
+ void __user *arg, |
+ size_t size) |
{ |
int result = 0; |
struct kgsl_sharedmem_from_pmem param; |
@@ -834,7 +835,14 @@ static long kgsl_ioctl_sharedmem_from_pmem(struct kgsl_file_private *private, |
unsigned long start = 0, vstart = 0, len = 0; |
struct file *pmem_file = NULL; |
- if (copy_from_user(¶m, arg, sizeof(param))) { |
+ if (!(size == sizeof(struct kgsl_sharedmem_from_pmem_old) || |
+ size == sizeof(param))) { |
+ result = -EINVAL; |
+ goto error; |
+ } |
+ |
+ memset(¶m, 0, sizeof(param)); |
+ if (copy_from_user(¶m, arg, size)) { |
result = -EFAULT; |
goto error; |
} |
@@ -881,7 +889,7 @@ static long kgsl_ioctl_sharedmem_from_pmem(struct kgsl_file_private *private, |
param.gpuaddr = entry->memdesc.gpuaddr; |
- if (copy_to_user(arg, ¶m, sizeof(param))) { |
+ if (copy_to_user(arg, ¶m, size)) { |
result = -EFAULT; |
goto error_unmap_entry; |
} |
@@ -1015,7 +1023,15 @@ static long kgsl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) |
case IOCTL_KGSL_SHAREDMEM_FROM_PMEM: |
kgsl_yamato_runpending(&kgsl_driver.yamato_device); |
result = kgsl_ioctl_sharedmem_from_pmem(private, |
- (void __user *)arg); |
+ (void __user *)arg, |
+ sizeof(struct kgsl_sharedmem_from_pmem)); |
+ break; |
+ |
+ case IOCTL_KGSL_SHAREDMEM_FROM_PMEM_OLD: |
+ kgsl_yamato_runpending(&kgsl_driver.yamato_device); |
+ result = kgsl_ioctl_sharedmem_from_pmem(private, |
+ (void __user *)arg, |
+ sizeof(struct kgsl_sharedmem_from_pmem_old)); |
break; |
case IOCTL_KGSL_DRAWCTXT_SET_BIN_BASE_OFFSET: |